CVE-2026-100520
highLaranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write ar…
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/crivion/laranode disclosure@vulncheck.com
- https://github.com/crivion/laranode/blob/v1.2/app/Actions/Filemanager/UploadFileAction.php disclosure@vulncheck.com
- https://github.com/crivion/laranode/commit/5c2b18ae99caf77a6fb6cc5c0ab66562bd673424 disclosure@vulncheck.com
- https://github.com/crivion/laranode/pull/21 disclosure@vulncheck.com
- https://github.com/crivion/laranode/releases/tag/v1.2.1 disclosure@vulncheck.com
- https://github.com/crivion/laranode/security/advisories/GHSA-34h2-2696-vfvr disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/laranode-before-1.2.1-path-traversal-in-file-manager-... disclosure@vulncheck.com